A PaperCut Zero-Day Has Now Outlasted Two Emergency Patches

PaperCut has spent the past few days chasing attackers who keep finding new ways into its print management software. The company issued an urgent security advisory on August 27, shipped a rushed emergency patch the same day, then had to ship a second one on August 28 after outside researchers reproduced the exploit chain and found bypasses in the first fix. The firms that found those bypasses say the newest patch already has holes of its own.

Two Flaws Chained Into Remote Code Execution

The vulnerability lives in PaperCut NG and PaperCut MF, the vendor’s print management software used by schools, government agencies, and businesses to track and control network printing. On August 27, PaperCut told customers that its “security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF,” after a university customer flagged suspicious activity and helped the company reproduce the bug.

At the time, PaperCut withheld technical detail and had not assigned a CVE identifier, saying it wanted customers to have time to patch before publishing anything an attacker could use as a roadmap. That changed the next day, when the company disclosed two distinct flaws that attackers are chaining together:

• CVE-2026-81578 (CVSS 8.8): an improper access control flaw in the PaperCut NG/MF web management interface. Under specific conditions, an unauthenticated remote request targeting an administrative function can trigger backend actions before the server finishes checking whether the requester is allowed to perform them.
• CVE-2026-82078 (CVSS 9.4): an unsafe dynamic class loading flaw in PaperCut’s database connection utilities. The application loads database driver classes based on a configurable driver name, without validating that name against an allowlist of approved drivers. An attacker who can manipulate that configuration can get PaperCut’s own server process to execute arbitrary Java bytecode.

Jake Knott, head of threat intelligence at exposure management firm watchTowr, explained the chain to The Hacker News in plain terms: “CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution.” Put together, the two bugs let an attacker with no credentials at all take full control of a PaperCut server that is reachable from the internet.

A Patch That Needed a Patch

PaperCut’s first response, published August 27, was explicitly a stopgap. “This is an emergency patch for customers with public-facing PaperCut NG/MF servers who are unable to take other mitigating action,” the company’s advisory read, and PaperCut acknowledged the update had skipped its normal release process and testing.

That caution turned out to be warranted. Security firm Huntress reproduced a full pre-authentication remote code execution chain against a stock, unpatched PaperCut NG server, while watchTowr independently reproduced the vulnerabilities, found multiple ways around the first emergency patch, and identified an additional authentication bypass that PaperCut had not caught. Both firms shared their findings with PaperCut.

On August 28, PaperCut released Emergency Patch Release 2, saying it added “additional hardening beyond the original emergency patch” after further work with its internal security team, Huntress, and watchTowr. PaperCut is urging every customer to install Release 2, including those who already applied the first emergency patch. Release 2 covers PaperCut NG and MF major versions 24, 25, and 26 on Windows, Linux, and macOS; customers on version 23 or earlier are told to upgrade rather than wait for a backport. Two other PaperCut components, Print Deploy and Mobility Print, are not affected and do not need updates.

Even Release 2 has not closed the book on this. Huntress says its own analysis of the second patch shows “security improvements that remediate parts of the attack chain as we understand it,” and confirms one of the bypasses it originally reported is now fixed. But watchTowr told The Hacker News it has already identified new patch bypasses affecting the latest, fully patched version, on top of the earlier ones. Neither firm has published exploit detail for the newest bypasses.

What Huntress Saw in the Wild

Huntress says it has observed limited exploitation in two customer environments so far, and the activity looks more like reconnaissance than a deployed payload. In both cases, attackers ran a Base64-encoded command that decoded to whoami & ver, identifying the account PaperCut was running under and the Windows version; another incident, also recorded on August 27, added tasklist to that same command to also capture a list of running processes.

The delivery mechanism is notable on its own. Attackers used an operating-system-agnostic Java .class file, planted through the vulnerable configuration path, to run commands on the underlying host and read or write files. Huntress says the payload it recovered wrote its output to a file called Udydn.out inside the application’s data directory, then deleted that file along with PaperCut’s own server.log and derby.log files, an apparent attempt to cover the intrusion’s tracks.

“At this time, we don’t have enough evidence to determine the threat actors’ ultimate end goal,” Huntress senior principal security researcher John Hammond told The Hacker News. “Based on what we observed, the activity appears consistent with early-stage reconnaissance or validation.” Huntress says it has not seen secondary malware, command-and-control traffic, or persistence deployed in the two confirmed incidents, but stresses that a clean log does not necessarily mean a server was never touched.

Why a Print Server Keeps Being a Target

PaperCut has been down this road before. Its CVE-2023-27350 authentication bypass, disclosed in 2023, was exploited by the Clop and LockBit ransomware operations and by Iranian state-linked hacking groups for initial network access; CISA and the FBI issued a joint advisory that year warning that the Bl00dy ransomware gang was specifically targeting PaperCut servers in the education sector. Three older PaperCut NG/MF vulnerabilities, including CVE-2023-27350, sit on CISA’s Known Exploited Vulnerabilities catalog today. As of this writing, neither CVE-2026-81578 nor CVE-2026-82078 has been added to that list.

Data from the ShadowServer Foundation, cited by SecurityWeek, puts roughly 1,000 PaperCut instances directly exposed to the internet right now, most of them in North America and Europe. Knott says that exposure is exactly what makes the software attractive to attackers with very different goals. “PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated,” he told The Hacker News.

What to Do Now

PaperCut and the researchers tracking this incident agree on the same immediate priorities for any organization running PaperCut NG or MF:

• Install Emergency Patch Release 2 for major versions 24, 25, or 26, even if the first emergency patch is already applied. Customers on version 23 or earlier should upgrade to a supported major version rather than wait for a backport.
• Remove PaperCut Application Servers from public-facing internet access regardless of patch status, and restrict the web interface to trusted internal IP addresses with firewall rules or network access controls.
• Watch for missing, truncated, or unexpectedly short server.log files, and for anomalous activity from the legitimate pc-app.exe process, two indicators PaperCut and Huntress both point to as possible signs of compromise.
• Preserve logs and any suspicious files instead of deleting them; PaperCut’s ongoing investigation, and any incident response an affected organization needs to run, depends on that evidence surviving.

PaperCut has not disclosed who is behind the attacks or said what, if anything, was taken from the two confirmed victim environments. With its own second fix already carrying new bypasses, the safer assumption for now is that patching alone will not fully close the door.